Date
July 1, 2025, 11:08 a.m.
| Environment | |
|---|---|
| qemu-arm64 | |
| qemu-x86_64 |
[ 18.446081] ================================================================== [ 18.446182] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x150/0x2f8 [ 18.446250] Write of size 16 at addr fff00000c7732469 by task kunit_try_catch/179 [ 18.446557] [ 18.446656] CPU: 1 UID: 0 PID: 179 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT [ 18.446767] Tainted: [B]=BAD_PAGE, [N]=TEST [ 18.446828] Hardware name: linux,dummy-virt (DT) [ 18.446863] Call trace: [ 18.446948] show_stack+0x20/0x38 (C) [ 18.447005] dump_stack_lvl+0x8c/0xd0 [ 18.447075] print_report+0x118/0x608 [ 18.447144] kasan_report+0xdc/0x128 [ 18.447262] kasan_check_range+0x100/0x1a8 [ 18.447376] __asan_memset+0x34/0x78 [ 18.447501] kmalloc_oob_memset_16+0x150/0x2f8 [ 18.447680] kunit_try_run_case+0x170/0x3f0 [ 18.447752] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.447809] kthread+0x328/0x630 [ 18.448006] ret_from_fork+0x10/0x20 [ 18.448061] [ 18.448081] Allocated by task 179: [ 18.448346] kasan_save_stack+0x3c/0x68 [ 18.448524] kasan_save_track+0x20/0x40 [ 18.448679] kasan_save_alloc_info+0x40/0x58 [ 18.448852] __kasan_kmalloc+0xd4/0xd8 [ 18.448983] __kmalloc_cache_noprof+0x16c/0x3c0 [ 18.449141] kmalloc_oob_memset_16+0xb0/0x2f8 [ 18.449257] kunit_try_run_case+0x170/0x3f0 [ 18.449368] kunit_generic_run_threadfn_adapter+0x88/0x100 [ 18.449590] kthread+0x328/0x630 [ 18.449627] ret_from_fork+0x10/0x20 [ 18.449691] [ 18.449713] The buggy address belongs to the object at fff00000c7732400 [ 18.449713] which belongs to the cache kmalloc-128 of size 128 [ 18.449968] The buggy address is located 105 bytes inside of [ 18.449968] allocated 120-byte region [fff00000c7732400, fff00000c7732478) [ 18.450182] [ 18.450257] The buggy address belongs to the physical page: [ 18.450350] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107732 [ 18.450463] flags: 0xbfffe0000000000(node=0|zone=2|lastcpupid=0x1ffff) [ 18.450530] page_type: f5(slab) [ 18.450609] raw: 0bfffe0000000000 fff00000c0001a00 dead000000000122 0000000000000000 [ 18.450706] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 18.450749] page dumped because: kasan: bad access detected [ 18.450784] [ 18.450802] Memory state around the buggy address: [ 18.450859] fff00000c7732300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 18.450916] fff00000c7732380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.450972] >fff00000c7732400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 18.451024] ^ [ 18.451068] fff00000c7732480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.451122] fff00000c7732500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 18.451173] ==================================================================
[ 11.670945] ================================================================== [ 11.671420] BUG: KASAN: slab-out-of-bounds in kmalloc_oob_memset_16+0x166/0x330 [ 11.671772] Write of size 16 at addr ffff88810258d269 by task kunit_try_catch/195 [ 11.672101] [ 11.672229] CPU: 0 UID: 0 PID: 195 Comm: kunit_try_catch Tainted: G B N 6.16.0-rc4 #1 PREEMPT(voluntary) [ 11.672279] Tainted: [B]=BAD_PAGE, [N]=TEST [ 11.672291] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.672313] Call Trace: [ 11.672326] <TASK> [ 11.672345] dump_stack_lvl+0x73/0xb0 [ 11.672388] print_report+0xd1/0x650 [ 11.672418] ? __virt_addr_valid+0x1db/0x2d0 [ 11.672442] ? kmalloc_oob_memset_16+0x166/0x330 [ 11.672463] ? kasan_complete_mode_report_info+0x2a/0x200 [ 11.672484] ? kmalloc_oob_memset_16+0x166/0x330 [ 11.672505] kasan_report+0x141/0x180 [ 11.672527] ? kmalloc_oob_memset_16+0x166/0x330 [ 11.672552] kasan_check_range+0x10c/0x1c0 [ 11.672575] __asan_memset+0x27/0x50 [ 11.672593] kmalloc_oob_memset_16+0x166/0x330 [ 11.672615] ? __pfx_kmalloc_oob_memset_16+0x10/0x10 [ 11.672637] ? __schedule+0x10cc/0x2b60 [ 11.672658] ? __pfx_read_tsc+0x10/0x10 [ 11.672680] ? ktime_get_ts64+0x86/0x230 [ 11.672705] kunit_try_run_case+0x1a5/0x480 [ 11.672729] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.672751] ? _raw_spin_lock_irqsave+0xa1/0x100 [ 11.672775] ? _raw_spin_unlock_irqrestore+0x5f/0x90 [ 11.672797] ? __kthread_parkme+0x82/0x180 [ 11.672818] ? preempt_count_sub+0x50/0x80 [ 11.672842] ? __pfx_kunit_try_run_case+0x10/0x10 [ 11.672865] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.672887] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [ 11.672909] kthread+0x337/0x6f0 [ 11.672928] ? trace_preempt_on+0x20/0xc0 [ 11.672951] ? __pfx_kthread+0x10/0x10 [ 11.672971] ? _raw_spin_unlock_irq+0x47/0x80 [ 11.672991] ? calculate_sigpending+0x7b/0xa0 [ 11.673014] ? __pfx_kthread+0x10/0x10 [ 11.673034] ret_from_fork+0x116/0x1d0 [ 11.673052] ? __pfx_kthread+0x10/0x10 [ 11.673071] ret_from_fork_asm+0x1a/0x30 [ 11.673102] </TASK> [ 11.673113] [ 11.680710] Allocated by task 195: [ 11.680900] kasan_save_stack+0x45/0x70 [ 11.681114] kasan_save_track+0x18/0x40 [ 11.681311] kasan_save_alloc_info+0x3b/0x50 [ 11.681531] __kasan_kmalloc+0xb7/0xc0 [ 11.681836] __kmalloc_cache_noprof+0x189/0x420 [ 11.682023] kmalloc_oob_memset_16+0xac/0x330 [ 11.682209] kunit_try_run_case+0x1a5/0x480 [ 11.682355] kunit_generic_run_threadfn_adapter+0x85/0xf0 [ 11.682649] kthread+0x337/0x6f0 [ 11.682823] ret_from_fork+0x116/0x1d0 [ 11.683013] ret_from_fork_asm+0x1a/0x30 [ 11.683184] [ 11.683264] The buggy address belongs to the object at ffff88810258d200 [ 11.683264] which belongs to the cache kmalloc-128 of size 128 [ 11.683631] The buggy address is located 105 bytes inside of [ 11.683631] allocated 120-byte region [ffff88810258d200, ffff88810258d278) [ 11.684105] [ 11.684295] The buggy address belongs to the physical page: [ 11.684565] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10258d [ 11.685181] flags: 0x200000000000000(node=0|zone=2) [ 11.685466] page_type: f5(slab) [ 11.685641] raw: 0200000000000000 ffff888100041a00 dead000000000122 0000000000000000 [ 11.686003] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 11.686256] page dumped because: kasan: bad access detected [ 11.686502] [ 11.686604] Memory state around the buggy address: [ 11.686837] ffff88810258d100: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 11.687178] ffff88810258d180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.687471] >ffff88810258d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc [ 11.687859] ^ [ 11.688073] ffff88810258d280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.688353] ffff88810258d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 11.688930] ==================================================================